Node2Shell: Brotli Decoder Flaw Enables Remote Code Execution in Node.js, Bun, and .NET
Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗
SentinelOne published an analysis of Node2Shell, a vulnerability in Google's Brotli decompression library that can be leveraged for remote code execution (RCE) in applications built on Node.js, Bun, and .NET. Because Brotli is a widely embedded compression codec, the flaw has broad reach across server-side JavaScript and .NET runtimes that decode Brotli-compressed content, such as HTTP request/response bodies. The vendor describes how attacker-controlled Brotli streams can trigger memory corruption or logic flaws in the decoder, ultimately leading to code execution within the host process. SentinelOne frames the post as guidance on detecting and blocking exploitation attempts using its endpoint protection platform.
Entenda a falha
A vulnerabilidade
Node2Shell is a flaw in the Brotli decoder, Google's decompression library, that SentinelOne says can lead to remote code execution in applications on Node.js, Bun and .NET. An attacker needs to get a crafted Brotli stream to an application that decompresses untrusted data, such as an HTTP body with Content-Encoding: br. The result is code execution inside the host process. No CVE is listed, and the articles do not state affected or fixed versions; they only advise applying updated Brotli library versions where available.
Como funciona
A server-side application receives compressed content, for example an HTTP request or response body marked as Brotli. The runtime hands the bytes to the shared Brotli decoder, which parses the stream and rebuilds the original data. According to SentinelOne, a specially crafted stream can trigger memory corruption or a logic flaw during this decoding, and the corruption lets the attacker run code in the process. The articles do not detail the exact step where decoding fails.
Por que é vulnerável
The articles say only that weaknesses in the decoder implementation, described as memory corruption or logic flaws, allow a crafted stream to be exploited. They do not name the specific root cause, such as a missing bounds check, nor explain why it went unnoticed or what the fix changes. Exposure is wide because the same Brotli library is shared by several runtimes and often processes untrusted network input.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. The only source is a SentinelOne blog post, published on 2026-10-30, that analyzes Node2Shell and explains how its endpoint platform protects customers against exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 18:16.
Detalhes técnicos
The vulnerability resides in the Brotli decoder used by multiple language runtimes to decompress data (e.g., HTTP payloads with Content-Encoding: br). Because Brotli decompression is commonly invoked on untrusted network input, a malicious or crafted compressed payload can exploit weaknesses in the decoder implementation to achieve remote code execution in the consuming application, affecting Node.js, Bun, and .NET environments that rely on the shared Brotli library.
Remediação
SentinelOne recommends applying updated Brotli library versions where available, auditing applications that decompress untrusted Brotli streams, and using endpoint detection to identify exploitation attempts targeting Node.js, Bun, and .NET processes handling Brotli-compressed data.
Linha do tempo
-
sentinelone.com ↗ · pub. 30/10/2026 12:06 · coletado 03/11 18:00 primeiro registro só resumo do feed
Node2Shell: Brotli Decoder Flaw Enables Remote Code Execution in Node.js, Bun, and .NET
ler a análise desta fonte ocultar
SentinelOne published an analysis of Node2Shell, a vulnerability in Google's Brotli decompression library that can be leveraged for remote code execution (RCE) in applications built on Node.js, Bun, and .NET. Because Brotli is a widely embedded compression codec, the flaw has broad reach across server-side JavaScript and .NET runtimes that decode Brotli-compressed content, such as HTTP request/response bodies. The vendor describes how attacker-controlled Brotli streams can trigger memory corruption or logic flaws in the decoder, ultimately leading to code execution within the host process. SentinelOne frames the post as guidance on detecting and blocking exploitation attempts using its endpoint protection platform.
Technical Details
The vulnerability resides in the Brotli decoder used by multiple language runtimes to decompress data (e.g., HTTP payloads with
Content-Encoding: br). Because Brotli decompression is commonly invoked on untrusted network input, a malicious or crafted compressed payload can exploit weaknesses in the decoder implementation to achieve remote code execution in the consuming application, affecting Node.js, Bun, and .NET environments that rely on the shared Brotli library.Remediation
SentinelOne recommends applying updated Brotli library versions where available, auditing applications that decompress untrusted Brotli streams, and using endpoint detection to identify exploitation attempts targeting Node.js, Bun, and .NET processes handling Brotli-compressed data.